Isolation Forest + eBPF events to create a Linux based endpoint detection system [P]

Hey everyone. I’ve been working on a machine learning project called guardd and wanted to get some feedback on the ML side of it. It’s basically a host-based anomaly detection system for Linux using Isolation Forest. I’m collecting exec and network events, grouping them into 60 second windows, then turning that into feature vectors that get scored by the model. Right now the features are things like counts of exec and network events, how many unique processes, files, IPs and ports show up in a